Unsolicited Response Podcast

Dale Peterson interviews guests who are pushing and prodding the ICS community to improve cyber security, as well as those in related fields with innovative ideas the ICS community should consider. Dale began his career as a NSA Cryptanalyst, has been securing ICS for over 20 years. He is the founder and program chair of the S4 Conference.

State Of NERC CIP, European Update and OT Security Community 04/24/2024

State Of NERC CIP, European Update and OT Security Community Patrick Miller has OT cybersecurity experience as an asset owner, PacificCorp. As a regulator and one of the first NERC CIP auditors with WECC. As a community organizer creating and leading EnergySec and the BeerISAC. And as an entrepreneur creating and leading a number of consulting practices. He is currently the Founder of Ampyx Cyber. In this episode Patrick and Dale discuss: Why Patrick changed the company name and selected Talinn as the location for the new European office. The major differences in approaches to OT cybersecurity and risk management between Europe and the US. (more than just regulatory differences) What has the EU learned or improved on regulation from NERC CIP. What is the current state of NERC CIP regulatory risk? Are the regulated entities understanding and meeting the standards’ requirements? The challenge of slow NERC CIP modifications, eg virtualization and cloud. Bad standard & good regulator v. good standard & bad regulator. Should water follow the NERC CIP model as recommended by AWWA? How Patrick is dealing with AI. Links Ampyx Cyber: Patrick’s Critical Assets Podcast: Subscribe to Dale’s ICS Security Friday News & Notes: Advertise on Unsolicited Response: /episode/index/show/unsolicitedresponse/id/30859823

Book Interview: Introduction To SBOM And VEX 04/17/2024

Book Interview: Introduction To SBOM And VEX /episode/index/show/unsolicitedresponse/id/30805738

S4x24 Closing Panel 04/10/2024

S4x24 Closing Panel /episode/index/show/unsolicitedresponse/id/30740178

Q1: ICS Security In Review 04/03/2024

Q1: ICS Security In Review Emma Stewart joins Dale to discuss the 3 big OT & ICS security stories from the first quarter. They end by giving their win, fail and prediction for Q1. /episode/index/show/unsolicitedresponse/id/30671298

S4x24 Preview 02/28/2024

S4x24 Preview /episode/index/show/unsolicitedresponse/id/30157488

Predictions Analyzed 12/20/2023

Predictions Analyzed In this solosode episode Dale reviews the status of his three predictions from the Q1, 2 and 3 quarter in review episodes and answers a listener question. /episode/index/show/unsolicitedresponse/id/29138748

Q4 ICS Security Quarter In Review 12/13/2023

Q4 ICS Security Quarter In Review /episode/index/show/unsolicitedresponse/id/29065763

CISA Attack Surface Scanning Service 12/06/2023

CISA Attack Surface Scanning Service Dale is joined by Steve Pozza, CISA Section Chief of Operational Resilience, and Tom Millar, CISA Branch Chief of Resilience, to discuss some of CISA's security services for asset owners. They discuss: The Internet accessible attack surface enumeration and vulnerability scanning surface. Asset owners can buy products or services to do this. Why is the government doing this? What CISA is doing with this attack surface data? How is CISA measuring the success of this service offering? Other broadly available services and tools, the cybersecurity performance goals (CPG assessment) ~500 done in 2023 (and their thinking about self-assessments), Malcom traffic analysis tool, and a couple of other tools. Links /episode/index/show/unsolicitedresponse/id/28944048

Engineering-Grade OT Security with Andrew Ginter 11/29/2023

Engineering-Grade OT Security with Andrew Ginter Andrew Ginter published his third book this year: . Dale interviews Andrew on the book including: Who was the target reader that Andrew wrote the book for? Do (should) professional engineers lose their licenses for poor and dangerous cybersecurity design and deployments? The use of the term engineering grade, and how he defines it. Unhackable protection and safety controls as a major part of engineering grade. Unidirectional (one-way) network devices as the only security control listed as engineering grade. Is one-way from the enterprise network to the OT network engineering grade? Given the ICSSTRIVE/Waterfall report that 75% of all cyber incidents affecting operations are due to ransomware on IT, should asset owners prioritize address this issue or engineering grade security first? What is keeping Andrew working rather than retiring Links to get a free copy of the book /episode/index/show/unsolicitedresponse/id/28828498

Asset Inventory, Lawyers, and AI 11/15/2023

Asset Inventory, Lawyers, and AI This week is a Dale Peterson solosode. Updates and Announcements Dale provides updates about S4x24 ticket sales and announces the Women In ICS Security program and sponsor package. Main Topics Asset Inventory in Cybersecurity: Dale challenges the common security mantra "You can't protect what you don't know," using examples from both physical and cyber domains. He notes many of the comments on this week's article missed the main point, and he gives hints on the next two asset inventory articles. Legal and Regulatory Issues in Cybersecurity: Dale emphasizes the importance of domain expertise whether it be cybersecurity or the legal profession. He previews upcoming keynote interviews with legal experts and advises cybersecurity professionals against making legal analyses without proper expertise. Artificial Intelligence in Cybersecurity: Dale reveals that most AI submissions for S4 were broad and hand wavy. This isn't wrong, but most have heard this info by now. He then discusses the need for focusing on specific, real-world applications of AI and stresses the importance of measurable improvements in this age of experimentation. /episode/index/show/unsolicitedresponse/id/28659848

Is The Purdue Model Dead (E) 11/08/2023

Is The Purdue Model Dead (E) /episode/index/show/unsolicitedresponse/id/28551173

Kelly Shortridge - Security Chaos Engineering in ICS 11/01/2023

Kelly Shortridge - Security Chaos Engineering in ICS Kelly joins Dale to discuss her new book . Kelly points out the second part of the title is the most descriptive, and she is not a big fan of the Chaos term that has taken hold. They discuss: A quick description of Security Chaos Engineering Is there similarity or overlap with the CCE or CIE approach? The value of decision trees Her view of checklists of security controls like CISA's CPG Lesson 1 - "Start in Nonproduction environments" The experiment / scientific method approach and how it can start small The Danger Zone: tight coupling and complex interactions How should ICS use Chaos Engineering /episode/index/show/unsolicitedresponse/id/28478732

IACS System Testing and Assessment Rating (STAR) Methodology with Don Weber 10/25/2023

IACS System Testing and Assessment Rating (STAR) Methodology with Don Weber Don Weber joins Dale Peterson to describe his IACS STAR Methodology to score the risk of a vulnerability to an ICS (or IACS in 62443-speak). It is a modification of the OWASP Risk Rating Methodology. Don has modified some of the 16-factors to create IACS STAR. The methodology and code is available on GitHub and a calculator is available on line. Don and Dale discuss: What Don likes about the OWASP Risk Rating Potential issues with putting numbers to SME judgment Differences between IACS STAR and the OWASP Risk Rating The weighting of the 16 factors The future of IACS STAR Links Slides Discussed In The Show: IACS STAR GitHub Repo: IACS STAR Calculator: Cutaway Security Website: ICS-Patch Decision Tree: /episode/index/show/unsolicitedresponse/id/28416230

Dave Whitehead On SBOMs, Manufacturing in the US, and more 10/18/2023

Dave Whitehead On SBOMs, Manufacturing in the US, and more Dave Whitehead, CEO of SEL, joins Dale on the show to talk about: The new SEL printed circuit board (PCB) factory in Idaho. Why they bucked the trend and did this. The benefits, the ROI, and more. SEL's position on providing SBOMs to customers and their internal use of SBOMs - Where leaders tend to go wrong. Substation shootings Market acceptance of SEL's Blueframe virtual platform Links /episode/index/show/unsolicitedresponse/id/28352861

Cyber Risk Quantification (CRQ) with Nicole Sundin 10/11/2023

Cyber Risk Quantification (CRQ) with Nicole Sundin Dale and Nicole Sundin of Axio discuss CRQ, how to deal with the precision challenge, Axio's prioritization of impact, ransomware on IT affecting operations as an example, and more. They also discuss UX and the single pane of glass. Links /episode/index/show/unsolicitedresponse/id/28171985

Presidential Candidate Will Hurd 10/04/2023

Presidential Candidate Will Hurd Former Congressman and Presidential candidate Will Hurd is a rarity with a tech background in someone who was elected to the US Congress, and even rarer in someone running for President. Will graduated Texas A&M with Computer Science degree. Worked as a Senior Adviser to the cybersecurity company FusionX, which was acquired by Accenture. More recently he was on the board of OpenAI. This is probably one of the most technical interviews with a Presidential candidate you will hear. Dale asks Will: How he would rate CISA's performance (he co-sponsored the bill to create CISA)? Does the Executive Branch have the authority required to secure critical infrastructure? His views on Cyber Command / DoD policy of "defend forward"? The current level of Congress's technical literacy? What type of cybersecurity legislation, if any, Congress should pass? /episode/index/show/unsolicitedresponse/id/28218695

ICS Security - Q3 In Review 09/27/2023

ICS Security - Q3 In Review Patrick Miller of Ampere Industrial Security joins Dale to discuss the three big stories of the quarter and give their win, fail and prediction. Stories US National Cybersecurity Strategy Implementation Plan + CISA 2024-2026 Strategic Plan The cybersecurity / OT cybersecurity vendor market news. We just had Cisco buy Splunk, plus the Dragos "extension", and SCADAfence selling to Honeywell. Seems like some tough times. Ransomware again … Port of Nagoya, Clorox, hospitals, CISA Ransomware Vulnerability Notification Service Links /episode/index/show/unsolicitedresponse/id/28160903

Dale Peterson On The Sunspace Alliance Webinar 09/20/2023

Dale Peterson On The Sunspace Alliance Webinar Dale Peterson was recently interviewed by Jay Johnson of Sandia and Tom Tansy of the as part of their distributed energy resources (DER) Sunspec webinar series. We covered a lot of issues and Dale was not shy in throwing out some analysis and opinions. After 5 minutes discussing the S4x24 ticket process, the topics discussed: How DER will deal with the complex, large number of users and stakeholders PKI environment. The Sunspec device security specification and the benefits of a limited, key set of security controls. What is the role of government regulation to solve DER security issues? The potential power of the utility companies to levy requirements and be a choke point for access. The Patch Act, FDA and DER. shift left and product liability due to security flaws and more /episode/index/show/unsolicitedresponse/id/28003188

Cyber-Physical Attacks with Marina Krotofil 09/06/2023

Cyber-Physical Attacks with Marina Krotofil Marina Krotofil recently published the paper which is a detailed paper on cyber attacks that cause a physical impact on the system being monitored and controlled. It took Marina 1.5 years to write this paper, which is more accurately described as a short book. We discuss: the work she is doing to help Ukrainian critical infrastructure security during wartime what got Marina interested in cyber-physical security 10+ years ago the current understanding of cyber-physical in the OT security community Chapter 2: Engineering Foundations as a great intro for those in IT to understand basic automation principles Chapter 3: Very detailed explanation of a specific process (we don't spend much time on this) The Cyber-Physical Attack Lifecycle with emphasis on the Damage Loop. "Plant shutdown is risky for the attacker as it may instigate an investigation" Chapter 4.6 is a great conclusion /episode/index/show/unsolicitedresponse/id/27952416

SBOMs & CycloneDX with Steve Springett 08/23/2023

SBOMs & CycloneDX with Steve Springett Steve Springett is the Chair of the OWASP CycloneDX Core Working Group. CycloneDX is one of the two main machine readable formats that SBOMs are being created in, although CycloneDX can capture all sorts of BOMs. In this episode we assume listeners know what a SBOM is and why it might be desired by a vendor and asset owner. The beginning of the show we cover some basics of CycloneDX If you know the basics, skip to 14:24 where we get into the details Statistics on who is generating and using CycloneDX SBOMs, and the impact of governement regulations on the use. Steve's view of the NTIA Minimum Elements for SBOM v. CycloneDX elements. How CycloneDX tries to capture the completeness of and confidence in the SBOM. The naming problem. CPE, CVE, NVD, SWID, PURL and more. Steve describes the problem and what he thinks is the way forward. Vulnerabilities ... and why Steve thinks VEX is a missed opportunity. Outdated component analysis (this could be very useful in a procurement decision) and more Links CycloneDX document: (what to patch when in ICS / risk based decision tree) /episode/index/show/unsolicitedresponse/id/27793530

The OT Cybersecurity / Climate Nexus with Andy Bochman 08/16/2023

The OT Cybersecurity / Climate Nexus with Andy Bochman At S4x23 Andy Bochman gave a Main Stage performance on the OT Cybersecurity / Climate Nexus. It's a new idea and Dale wanted to dig into it and understand it better. The discussion looks at where there is a nexus/connection/overlap and where there may be parallel efforts where each side might learn from the other. Links /episode/index/show/unsolicitedresponse/id/27751518

Water Sector Cyber Risk with Gus Serino 08/09/2023

Water Sector Cyber Risk with Gus Serino Gus Serino worked at a large water utility before joining Dragos in 2019. We're talking water sector so it's obligatory to start with Oldsmar (2:20), but we don't talk cyber. Instead we go through the physical portion of the water system assuming the attacker is able to issue the command to the pump to dump a lot of sodium hydroxide into the water system and what would likely happen. Importantly Gus identifies the simple, unhackable solution to this threat. A hard wired PH sensor that will shut off the pump regardless of the commands from the ICS. After Oldsmar Dale and Gus discuss: how small and medium water systems should approach cyber risk the greater challenge to large water systems the EPA's early steps on cybersecurity and future regulation - surprises in moving from a water utility to Dragos what Gus's new I&C Secure company is doing /episode/index/show/unsolicitedresponse/id/27655440

One-Way, SAIDI & S4x24 CFP 08/02/2023

One-Way, SAIDI & S4x24 CFP This is a solo-sode where Dale reviews two articles from July with comments on comments and additional thoughts. The final section is a must listen if you are going to submit to speak on the S4x24 Stage. The times below are so you can skip to what you are interested in. 1:29 One-Way Data Diodes and School Zones 10:15 SAIDI: What Cyber Incidents Should Be Excluded From Metrics 16:05 Do's and Don'ts For Your S4x24 CFP Submission Links /episode/index/show/unsolicitedresponse/id/27631194

Interview with HD Moore 07/26/2023

Interview with HD Moore HD Moore is most famous for his creation of the Metasploit penetration testing framework. It began in 2003 and hit the OT world in 2011. HD is now the Founder and CTO of RunZero, another cybersecurity startup that is starting to play in the OT Space. In this episode we spend the first third of the show talking about Metasploit ... early reaction, OT modules, is Metasploit still necessary and useful today. We then shift to creating asset inventories in IT and OT, which is what RunZero does. Why HD decided to run back into the cybersecurity startup world? How it started as a solo shop with HD writing all the code. How HD things Shodan and RunZero are different. What technique does RunZero use to 'scan'. A term that many fear in OT. Check out their approach to 'fragile devices'. The OT reaction to this type of scanning. What role uses the RunZero product? Links /episode/index/show/unsolicitedresponse/id/27451509

US Dept of Energy's OT Defender Fellowship Program 07/19/2023

US Dept of Energy's OT Defender Fellowship Program Dale is often critical of the US Government's efforts and programs to address OT cyber risk. So it's a pleasure to highlight a program that is working. Samantha Ravich, Chair of the Center on Cyber and Technology Innovation at the Foundation for the Defense of Democracies, joins Dale to discuss the US Department of Energy's OT Defender Fellowship Program. They begin by describing the program, its goals, what are ideal candidates for the program, and the early results from the first few cohorts. Then Timothy Pospisil of Nebraska Public Power District and part of the 2022 OT Defender Fellowship cohort joins the show to discuss his experience in the program. At the end we discuss how this could be expanded to address water, critical manufacturing and other sectors. Link /episode/index/show/unsolicitedresponse/id/27450123

Eric Cosman On Dow, Open Automation, 62443 & More 07/12/2023

Eric Cosman On Dow, Open Automation, 62443 & More Eric Cosman had a 38 year career at Dow Chemical, was on the ISA 99 committee its inception, and then he retired. After retirement Eric joined ARC Advisory Group as a Contributing Consultant and got even more active with ISA. He is a long time co-chair of ISA99 and was President of ISA in 2020. Eric and Dale discuss: Dow's in house developed DCS and SIS: MOD Eric's top trend from 2022: The value of open automation and the Open Process Automation Forum ISA/IEC 62433 Eric's view they are "primarily engineering standards" What Eric thinks about the safety / security analogies His experience in being ISA President in the first year of COVID ISA as "the home of automation" Has ISA lost mindshare on ICS security standards to the US Government and training to SANS /episode/index/show/unsolicitedresponse/id/27440697

ICS Security Quarter In Review Q2-2023 07/05/2023

ICS Security Quarter In Review Q2-2023 Mark Hyman of Verge Management Group joins Dale to discuss the big 3 stories of Q2 along with their win, fail and predication. Big Stories The OT Security Layoffs (Mark is a recruiter specialized in ICS/OT security) Still No US National Cyber Director? The Merck NotPetya Insurance Claim Ruling Plus they both have a win, fail and prediction at the end. /episode/index/show/unsolicitedresponse/id/27379461

Josh Corman - Healthcare Security, SBOMs & More 06/28/2023

Josh Corman - Healthcare Security, SBOMs & More Josh Corman is the VP of Cyber Safety Strategy at Claroty, was the Chief Strategist of the CISA COVID Task Force, and founder of I Am The Cavalry. Josh and I dive into Healthcare Security, SBOMs and other topics. Can OT in healthcare be treated in a similar way as the factory, power plant, water treatment plant, ... ? The first fatality due to a cyber attack on a hospital. Should we be focusing our efforts on reducing the impact if ransomware hits a healthcare facility? What is the equivalent to a steel reinforced cockpit door? The PATCH Act (included in the Omnibus bill passed in Dec 2022) requiring medical device manufactures to provide a SBOM and a patching program. What is it? What will be the impact of this? (BTW, Josh changed my mind on this as a start to a long term impact) Will the PATCH Act provisions delay approval of medical devices? How accurate and complete are vendor generated SBOMs today? How will this be solved? What will be the impact of SBOM mandates? Differing views on the importance to society of attacks and outages in the agriculture / food industry I Am The Cavalry turns 10. We will need to have Josh back for a Part 2. /episode/index/show/unsolicitedresponse/id/27308709

OTCEP Panel - Secure PLC Coding Practices 06/21/2023

OTCEP Panel - Secure PLC Coding Practices This episode is a replay of a lively panel from the Cyber Security Agency of Singapore's OT Cybersecurity Expert Panel (OTCEP) last year. It begins with a great introduction to the Top 20 Secure PLC Coding Practices by Sarah Fluchs. At the 35 minute mark the panel discussion begins. There was a lot more disagreement and back and forth than the typical panel. This gives you a variety of points of view and positions to consider. Paul Griswold moderated the panel of Dr. Ong Chen Hui, Joel Langill, Sarah Fluchs and Dale Peterson. Links , August 22 - 23 in Singapore /episode/index/show/unsolicitedresponse/id/27199728

Metrics: How Effective Is A Security Control? 05/17/2023

Metrics: How Effective Is A Security Control? How much does a security control reduce cyber risk? What control or mix of controls provides the most efficient cyber risk reduction? Tough questions that a team of researchers at INL and Sandia tried to answer in a project. Two of the researchers, Jay Johnson of Sandia and Jake Gentle of INL, join Dale on the show to talk about the metrics and results. The project was Cyber Resilience for Wind Installations, but the metrics and results are applicable to every sector. We get into the weeds on this episode and discuss: how they created the test environment the two attack scenarios (and why only two and how easy it would be to expand) the physical resilience score the cyber resilience score the results from four different mixes of security controls areas for further testing and improvement and a tiny bit about trying to calculate an Expected Benefit from Cybersecurity Investment, which is a bit like ROI and how much money to spend. Links • Video: • IEEE Access Journal Paper: • POWER magazine article: • 2-page flyer: • Final project report: /episode/index/show/unsolicitedresponse/id/26869272

Unsolicited Response Podcast

TOPICS